CVE-2026-28941: Apple iPadOS DOS Vulnerability

CVE-2026-28941 Overview

CVE-2026-28941 is a memory safety vulnerability affecting Apple iOS, iPadOS, and macOS. The flaw allows a maliciously crafted file to trigger a denial-of-service condition or disclose process memory contents when processed by an affected system. Apple addressed the issue through improved validation checks in iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, and macOS Tahoe 26.5. The vulnerability is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and requires user interaction to exploit. No public exploit code is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact

Successful exploitation can crash affected services or leak sensitive memory contents from the targeted device, including data from adjacent processes.

Affected Products

• Apple iOS prior to 18.7.9
• Apple iPadOS prior to 18.7.9
• Apple macOS Sequoia prior to 15.7.7 and macOS Tahoe prior to 26.5

Discovery Timeline

• 2026-05-11 - CVE-2026-28941 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-28941

Vulnerability Analysis

The vulnerability resides in Apple's file processing logic across iOS, iPadOS, and macOS. When the affected component parses a maliciously crafted file, it performs operations outside the bounds of an allocated memory buffer. This boundary violation produces two distinct outcomes depending on the exploitation path: an application crash resulting in denial of service, or the disclosure of adjacent memory contents to the attacker. Apple's advisory states the issue was resolved with improved checks, indicating that the original code path lacked sufficient validation before performing memory operations on attacker-controlled file data.

Root Cause

The root cause is improper restriction of operations within the bounds of a memory buffer, classified as [CWE-119]. The affected parsing routine accepts file structures without enforcing size or offset constraints prior to dereferencing pointers or reading buffer contents. An attacker who controls the file structure can therefore influence the memory regions accessed by the parser.

Attack Vector

Exploitation requires a victim to process an attacker-supplied file on an affected device. The attack vector is network-accessible because malicious files can be delivered through email attachments, web downloads, messaging applications, or shared cloud storage. User interaction is required to open or preview the file. Successful exploitation does not require prior authentication or elevated privileges on the target system.

No verified public proof-of-concept code is available for this vulnerability. Technical details beyond Apple's brief advisory have not been published. Refer to the Apple Support Article #127111, Apple Support Article #127115, and Apple Support Article #127116 for vendor-provided information.

Detection Methods for CVE-2026-28941

Indicators of Compromise

• Repeated crashes of file-handling processes or system services on iOS, iPadOS, or macOS endpoints, recorded in CrashReporter logs.
• Inbound files from untrusted sources delivered via email, messaging, or web channels that trigger unexpected application terminations on receipt or preview.
• Anomalous file types or malformed file headers logged by endpoint telemetry during automated previews or Quick Look operations.

Detection Strategies

• Monitor macOS unified logs and iOS crash reports for recurring termination signatures in file-parsing components after a user opens an attachment.
• Inspect email and web gateway logs for delivery of files with abnormal structure or mismatched magic bytes that target file parsers on Apple platforms.
• Correlate device crash telemetry with recent file downloads to identify candidate malicious documents for further analysis.

Monitoring Recommendations

• Track installed OS versions across the fleet and flag devices still running iOS, iPadOS, or macOS builds below the fixed versions.
• Forward macOS endpoint logs to a centralized analytics platform to baseline normal parser behavior and surface deviations.
• Alert on processes that crash within a short interval of file open events originating from external sources.

How to Mitigate CVE-2026-28941

Immediate Actions Required

• Update all Apple devices to iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, or macOS Tahoe 26.5 or later.
• Use mobile device management (MDM) policies to enforce minimum OS versions and block non-compliant devices from corporate resources.
• Instruct users to avoid opening files from untrusted senders until patches are deployed.

Patch Information

Apple released fixed versions on the platforms identified in the advisories. Administrators should reference Apple Support Article #127111, Apple Support Article #127115, and Apple Support Article #127116 for the full list of resolved issues and version-specific update instructions. Patches are delivered through standard Software Update channels on each platform.

Workarounds

• Restrict automatic file previews in email clients and messaging applications until updates are applied.
• Filter inbound files at email and web gateways, blocking or sandboxing file types associated with the vulnerable parser.
• Apply application allow-listing on macOS to limit which processes can open attacker-supplied files.

# Verify current macOS version and trigger software update
sw_vers -productVersion
sudo softwareupdate --install --all --restart